CVE-2026-5203
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A vulnerability was found in CMS Made Simple up to version 2.2.22 in the _copyFilesToFolder function of the UserGuide Module XML Import component. Manipulation leads to path traversal, enabling remote attack. The exploit is publicly available, and the project confirmed it has been fixed in the next release.
Risk Assessment
Path traversal could allow an attacker to read or write files outside the allowed directory, threatening system confidentiality and integrity.
Recommendation
Update CMS Made Simple to the latest version that includes the fix or apply temporary mitigations such as path validation.
Original NVD description (English source)
A vulnerability was found in CMS Made Simple up to 2.2.22. This impacts the function _copyFilesToFolder in the library modules/UserGuide/lib/class.UserGuideImporterExporter.php of the component UserGuide Module XML Import. The manipulation results in path traversal. It is possible to launch the attack remotely. The exploit has been made public and could be used. This issue has been reported early to the project. They confirmed, that "this has already been discovered and fixed for the next release."